@sixb/core 0.1.1 → 0.1.2

package/dist/connectors/connections/credential-codec.d.ts

@@ -0,0 +1,15 @@
+import type { ConnectorCredentialProtector, SealedConnectorCredential } from "../credentials";
+import type { ConnectorOAuthCredentials } from "../types";
+export interface ConnectorCredentialCodecOptions {
+    readonly projectId: string;
+    readonly protector: ConnectorCredentialProtector;
+}
+/** Authenticated serialization boundary for one project's OAuth credential envelopes. */
+export declare class ConnectorCredentialCodec {
+    private readonly options;
+    constructor(options: ConnectorCredentialCodecOptions);
+    seal(connectorId: string, authorizationId: string, credentials: ConnectorOAuthCredentials): Promise<SealedConnectorCredential>;
+    open(connectorId: string, authorizationId: string, credentials: SealedConnectorCredential): Promise<ConnectorOAuthCredentials>;
+    private context;
+}
+//# sourceMappingURL=credential-codec.d.ts.map

package/dist/connectors/connections/credential-codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-codec.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/credential-codec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAA;AAC7F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAMzD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,4BAA4B,CAAA;CACjD;AAED,yFAAyF;AACzF,qBAAa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,+BAA+B;IAErE,IAAI,CACF,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAAC,yBAAyB,CAAC;IAO/B,IAAI,CACR,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAAC,yBAAyB,CAAC;IAQrC,OAAO,CAAC,OAAO;CAQhB"}

package/dist/connectors/connections/credential-mutations.d.ts

@@ -0,0 +1,63 @@
+import type { ClaimConnectorCredentialMutationResult, ConnectorAuthorizationRecord, ConnectorConnectionStorage, ConnectorCredentialMutationKind, ConnectorStagedCredentials } from "../../storage";
+import type { SealedConnectorCredential } from "../credentials";
+import { createConnectorCodedError } from "../errors";
+import type { ConnectorAccountCandidate } from "../types";
+export type ConnectorCredentialMutationClaimOutcome = {
+    readonly type: "claimed";
+    readonly claim: ClaimConnectorCredentialMutationResult;
+} | {
+    readonly type: "superseded";
+    readonly authorization: ConnectorAuthorizationRecord;
+};
+export interface ConnectorCredentialMutationCoordinatorOptions {
+    readonly projectId: string;
+    readonly storage: ConnectorConnectionStorage;
+    readonly leaseDurationMs: number;
+    readonly operationTimeoutMs: number;
+    /** Returns the current host signal; the host may replace its controller after closing. */
+    readonly hostSignal: () => AbortSignal;
+    readonly discoverReauthorizationAccounts: (authorization: ConnectorAuthorizationRecord, staged: ConnectorStagedCredentials) => Promise<readonly ConnectorAccountCandidate[]>;
+    /** Injectable for deterministic tests. A unique value is generated in normal operation. */
+    readonly holderId?: string;
+}
+export interface StageConnectorCredentialMutationInput {
+    readonly credentials: SealedConnectorCredential;
+    readonly credentialExpiresAt?: Date;
+    readonly scopes: readonly string[];
+}
+/**
+ * Coordinates every provider-side OAuth credential mutation.
+ *
+ * Storage owns the durable fence and deadline. This coordinator owns process-local serialization,
+ * lease renewal, provider deadlines, ambiguous-outcome handling, and staged-result finalization.
+ */
+export declare class ConnectorCredentialMutationCoordinator {
+    private readonly projectId;
+    private readonly storage;
+    private readonly leaseDurationMs;
+    private readonly operationTimeoutMs;
+    private readonly hostSignal;
+    private readonly discoverReauthorizationAccounts;
+    private readonly holderId;
+    private readonly localMutationTails;
+    constructor(options: ConnectorCredentialMutationCoordinatorOptions);
+    claimCredentialMutation(connectorId: string, initial: ConnectorAuthorizationRecord, kind: ConnectorCredentialMutationKind, expectedConnectionIds?: readonly string[]): Promise<ConnectorCredentialMutationClaimOutcome>;
+    prepareAuthorizationForMutation(connectorId: string, initial: ConnectorAuthorizationRecord, requestedKind: ConnectorCredentialMutationKind): Promise<ConnectorAuthorizationRecord>;
+    recoverExpiredCredentialMutation(connectorId: string, authorizationId: string): Promise<ConnectorAuthorizationRecord | null>;
+    executeCredentialMutation<T>(authorization: ConnectorAuthorizationRecord, run: (executing: ConnectorAuthorizationRecord, signal: AbortSignal) => Promise<T>): Promise<T>;
+    stageCredentialMutationCredentials(executing: ConnectorAuthorizationRecord, signal: AbortSignal, input: StageConnectorCredentialMutationInput): Promise<ConnectorAuthorizationRecord>;
+    stageCredentialMutationRevocation(executing: ConnectorAuthorizationRecord, signal: AbortSignal): Promise<ConnectorAuthorizationRecord>;
+    withBoundedProviderSignal<T>(run: (signal: AbortSignal) => Promise<T> | T, interruptionError?: () => Error): Promise<T>;
+    finalizeStagedMutation(authorization: ConnectorAuthorizationRecord): Promise<ConnectorAuthorizationRecord>;
+    markNeedsReauthorization(authorization: ConnectorAuthorizationRecord): Promise<ConnectorAuthorizationRecord | null>;
+    releaseCredentialMutation(authorization: ConnectorAuthorizationRecord): Promise<boolean>;
+    requireStableActiveAuthorization(connectorId: string, authorizationId: string): Promise<ConnectorAuthorizationRecord>;
+    assertAttachedConnections(connectorId: string, authorizationId: string, expectedConnectionIds: readonly string[]): Promise<void>;
+    runLocallySerialized<T>(authorizationId: string, run: () => Promise<T>): Promise<T>;
+    isStagedMutation(authorization: ConnectorAuthorizationRecord, claimed: ConnectorAuthorizationRecord, kind: ConnectorCredentialMutationKind): boolean;
+    private withCredentialMutationSignal;
+    private requireAuthorization;
+}
+export declare function assertCredentialMutationOperationActive(signal: AbortSignal): void;
+export declare function connectorAuthorizationStatusError(status: ConnectorAuthorizationRecord["status"]): ReturnType<typeof createConnectorCodedError>;
+//# sourceMappingURL=credential-mutations.d.ts.map

package/dist/connectors/connections/credential-mutations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-mutations.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/credential-mutations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sCAAsC,EACtC,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,0BAA0B,EAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EAEL,yBAAyB,EAK1B,MAAM,WAAW,CAAA;AAClB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAQzD,MAAM,MAAM,uCAAuC,GAC/C;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,sCAAsC,CAAA;CACvD,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,aAAa,EAAE,4BAA4B,CAAA;CACrD,CAAA;AAEL,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAA;IAC5C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,0FAA0F;IAC1F,QAAQ,CAAC,UAAU,EAAE,MAAM,WAAW,CAAA;IACtC,QAAQ,CAAC,+BAA+B,EAAE,CACxC,aAAa,EAAE,4BAA4B,EAC3C,MAAM,EAAE,0BAA0B,KAC/B,OAAO,CAAC,SAAS,yBAAyB,EAAE,CAAC,CAAA;IAClD,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAA;IAC/C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED;;;;;GAKG;AACH,qBAAa,sCAAsC;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAQ;IACxC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAQ;IAC3C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAGE;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAmC;gBAE1D,OAAO,EAAE,6CAA6C;IAgB5D,uBAAuB,CAC3B,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,4BAA4B,EACrC,IAAI,EAAE,+BAA+B,EACrC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,GACxC,OAAO,CAAC,uCAAuC,CAAC;IA4D7C,+BAA+B,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,4BAA4B,EACrC,aAAa,EAAE,+BAA+B,GAC7C,OAAO,CAAC,4BAA4B,CAAC;IAiBlC,gCAAgC,CACpC,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAYzC,yBAAyB,CAAC,CAAC,EAC/B,aAAa,EAAE,4BAA4B,EAC3C,GAAG,EAAE,CAAC,SAAS,EAAE,4BAA4B,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAChF,OAAO,CAAC,CAAC,CAAC;IAmBP,kCAAkC,CACtC,SAAS,EAAE,4BAA4B,EACvC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,qCAAqC,GAC3C,OAAO,CAAC,4BAA4B,CAAC;IAmBlC,iCAAiC,CACrC,SAAS,EAAE,4BAA4B,EACvC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,4BAA4B,CAAC;IAclC,yBAAyB,CAAC,CAAC,EAC/B,GAAG,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAC5C,iBAAiB,GAAE,MAAM,KAA6C,GACrE,OAAO,CAAC,CAAC,CAAC;IAQP,sBAAsB,CAC1B,aAAa,EAAE,4BAA4B,GAC1C,OAAO,CAAC,4BAA4B,CAAC;IAoElC,wBAAwB,CAC5B,aAAa,EAAE,4BAA4B,GAC1C,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAQzC,yBAAyB,CAAC,aAAa,EAAE,4BAA4B,GAAG,OAAO,CAAC,OAAO,CAAC;IAYxF,gCAAgC,CACpC,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,4BAA4B,CAAC;IA4BlC,yBAAyB,CAC7B,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,qBAAqB,EAAE,SAAS,MAAM,EAAE,GACvC,OAAO,CAAC,IAAI,CAAC;IAoBV,oBAAoB,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAiBzF,gBAAgB,CACd,aAAa,EAAE,4BAA4B,EAC3C,OAAO,EAAE,4BAA4B,EACrC,IAAI,EAAE,+BAA+B,GACpC,OAAO;YAUI,4BAA4B;YAkD5B,oBAAoB;CAqBnC;AAED,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAEjF;AAED,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,4BAA4B,CAAC,QAAQ,CAAC,GAC7C,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAuB9C"}

package/dist/connectors/connections/execution.d.ts

@@ -0,0 +1,20 @@
+import type { ExecutionContext } from "../../execution/types";
+import type { SixbRuntimeContext } from "../../runtime/types";
+import type { AddConnectorConnectionInput, CompleteConnectorAuthorizationInput, CompleteConnectorAuthorizationResult, ConnectorConnectionProcess, ConnectorConnectionRunView, ConnectorConnectionView, RevokeConnectorAuthorizationResult, SelectConnectorAccountInput, SelectConnectorConnectionRunAccountInput, StartConnectorAuthorizationInput, StartConnectorAuthorizationResult, StartConnectorConnectionRunInput, StartConnectorConnectionRunResult } from "./contracts";
+/** Internal connector-connection lifecycle API bound to one authenticated request execution. */
+export interface ConnectorConnectionsRuntime {
+    listConnections(connectorId: string): Promise<readonly ConnectorConnectionView[]>;
+    startConnectionRun(connectorId: string, input: StartConnectorConnectionRunInput): Promise<StartConnectorConnectionRunResult>;
+    addConnection(connectorId: string, input: AddConnectorConnectionInput): Promise<ConnectorConnectionRunView>;
+    getConnectionRun(connectorId: string, runId: string): Promise<ConnectorConnectionRunView | null>;
+    selectConnectionRunAccount(connectorId: string, input: SelectConnectorConnectionRunAccountInput): Promise<ConnectorConnectionRunView>;
+    startReauthorization(connectorId: string, connectionId: string, input: Pick<StartConnectorConnectionRunInput, "redirectUri" | "returnTo">): Promise<StartConnectorConnectionRunResult>;
+    revokeConnection(connectorId: string, connectionId: string): Promise<RevokeConnectorAuthorizationResult>;
+    startAuthorization(connectorId: string, input: StartConnectorAuthorizationInput): Promise<StartConnectorAuthorizationResult>;
+    completeAuthorization(connectorId: string, input: CompleteConnectorAuthorizationInput): Promise<CompleteConnectorAuthorizationResult>;
+    selectAccount(connectorId: string, input: SelectConnectorAccountInput): Promise<ConnectorConnectionView>;
+    disconnect(connectorId: string, connectionId: string): Promise<ConnectorConnectionView | null>;
+    revokeAuthorization(connectorId: string, authorizationId: string): Promise<RevokeConnectorAuthorizationResult>;
+}
+export declare function createConnectorConnectionsRuntime(runtime: SixbRuntimeContext, execution: ExecutionContext, process: ConnectorConnectionProcess): ConnectorConnectionsRuntime;
+//# sourceMappingURL=execution.d.ts.map

package/dist/connectors/connections/execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/execution.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,KAAK,EACV,2BAA2B,EAC3B,mCAAmC,EACnC,oCAAoC,EAEpC,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,EACvB,kCAAkC,EAClC,2BAA2B,EAC3B,wCAAwC,EACxC,gCAAgC,EAChC,iCAAiC,EACjC,gCAAgC,EAChC,iCAAiC,EAClC,MAAM,aAAa,CAAA;AAEpB,gGAAgG;AAChG,MAAM,WAAW,2BAA2B;IAC1C,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAAA;IACjF,kBAAkB,CAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,iCAAiC,CAAC,CAAA;IAC7C,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAAA;IACtC,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAAA;IAChG,0BAA0B,CACxB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,wCAAwC,GAC9C,OAAO,CAAC,0BAA0B,CAAC,CAAA;IACtC,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,IAAI,CAAC,gCAAgC,EAAE,aAAa,GAAG,UAAU,CAAC,GACxE,OAAO,CAAC,iCAAiC,CAAC,CAAA;IAC7C,gBAAgB,CACd,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,kCAAkC,CAAC,CAAA;IAC9C,kBAAkB,CAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,iCAAiC,CAAC,CAAA;IAC7C,qBAAqB,CACnB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,mCAAmC,GACzC,OAAO,CAAC,oCAAoC,CAAC,CAAA;IAChD,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,uBAAuB,CAAC,CAAA;IACnC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAA;IAC9F,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,kCAAkC,CAAC,CAAA;CAC/C;AAED,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,kBAAkB,EAC3B,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,0BAA0B,GAClC,2BAA2B,CA6B7B"}

package/dist/connectors/connections/internal.d.ts

@@ -0,0 +1,5 @@
+export { isOAuthConnectorDefinition } from "../types";
+export { getConnectorConnectionCallbackProcess, getConnectorConnectionsRuntime, } from "./capability";
+export type { AddConnectorConnectionInput, CompleteConnectorConnectionRunInput, CompleteConnectorConnectionRunResult, ConnectorConnectionRunView, ConnectorConnectionView, RevokeConnectorAuthorizationResult, SelectConnectorConnectionRunAccountInput, StartConnectorConnectionRunInput, StartConnectorConnectionRunResult, } from "./contracts";
+export type { ConnectorConnectionsRuntime } from "./execution";
+//# sourceMappingURL=internal.d.ts.map

package/dist/connectors/connections/internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/internal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAA;AACrD,OAAO,EACL,qCAAqC,EACrC,8BAA8B,GAC/B,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,2BAA2B,EAC3B,mCAAmC,EACnC,oCAAoC,EACpC,0BAA0B,EAC1B,uBAAuB,EACvB,kCAAkC,EAClC,wCAAwC,EACxC,gCAAgC,EAChC,iCAAiC,GAClC,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA"}

package/dist/connectors/connections/internal.js

@@ -0,0 +1,16 @@
+// @bun
+import {
+  isOAuthConnectorDefinition
+} from "../../chunk-8m5ejdpn.js";
+import {
+  getConnectorConnectionCallbackProcess,
+  getConnectorConnectionsRuntime
+} from "../../chunk-nf4r78r4.js";
+import"../../chunk-y64skrwp.js";
+export {
+  isOAuthConnectorDefinition,
+  getConnectorConnectionsRuntime,
+  getConnectorConnectionCallbackProcess
+};
+
+//# debugId=EA5CF4070494D18664756E2164756E21

package/dist/connectors/connections/internal.js.map

@@ -0,0 +1,9 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [
+  ],
+  "mappings": "",
+  "debugId": "EA5CF4070494D18664756E2164756E21",
+  "names": []
+}

package/dist/connectors/connections/provider-operation.d.ts

@@ -0,0 +1,7 @@
+export interface BoundedConnectorProviderOperationOptions {
+    readonly hostSignal: AbortSignal;
+    readonly timeoutMs: number;
+}
+/** Bound one provider call to both the current host lifetime and an explicit deadline. */
+export declare function runBoundedConnectorProviderOperation<T>(options: BoundedConnectorProviderOperationOptions, run: (signal: AbortSignal) => Promise<T> | T, interruptionError?: () => Error): Promise<T>;
+//# sourceMappingURL=provider-operation.d.ts.map

package/dist/connectors/connections/provider-operation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-operation.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/provider-operation.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,0FAA0F;AAC1F,wBAAsB,oCAAoC,CAAC,CAAC,EAC1D,OAAO,EAAE,wCAAwC,EACjD,GAAG,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAC5C,iBAAiB,GAAE,MAAM,KAA6C,GACrE,OAAO,CAAC,CAAC,CAAC,CAwBZ"}

package/dist/connectors/connections/request.d.ts

@@ -0,0 +1,84 @@
+import type { AuthorizablePrincipal } from "../../execution";
+import type { ConnectorAuthorizationAttemptRecord, ConnectorAuthorizationRecord, ConnectorConnectionRecord, CreateConnectorAuthorizationAttemptInput, Storage } from "../../storage";
+import type { ConnectorCredentialProtector } from "../credentials";
+import type { ConnectorDefinition, OAuthConnectorAdapter } from "../types";
+import { type ConnectorConnectionCommandActor } from "./command-context";
+import type { CompleteConnectorAuthorizationInput, CompleteConnectorAuthorizationResult, ConnectorConnectionCommandContext, ConnectorConnectionView, StartConnectorAuthorizationInput, StartConnectorAuthorizationResult } from "./contracts";
+type OAuthConnectorDefinition = ConnectorDefinition<string, OAuthConnectorAdapter>;
+export type ResolveOAuthConnectorDefinition = (connectorId: string) => OAuthConnectorDefinition;
+export interface PrepareConnectorReauthorizationInput {
+    readonly definition: OAuthConnectorDefinition;
+    readonly authorizationId: string;
+    readonly principal: AuthorizablePrincipal;
+}
+export interface PreparedConnectorReauthorization {
+    readonly authorization: ConnectorAuthorizationRecord;
+    readonly connections: readonly ConnectorConnectionRecord[];
+}
+export interface CompleteNewConnectorAuthorizationInput {
+    readonly definition: OAuthConnectorDefinition;
+    readonly principal: AuthorizablePrincipal;
+    readonly code: string;
+    readonly codeVerifier: string;
+    readonly redirectUri: string;
+    /** Called immediately after the encrypted grant is durable, before account discovery. */
+    readonly onAuthorizationPersisted?: (authorization: ConnectorAuthorizationRecord) => Promise<void>;
+}
+export interface CompleteConnectorReauthorizationInput extends CompleteNewConnectorAuthorizationInput {
+    readonly authorizationId: string;
+    readonly expectedRevision: number;
+    readonly expectedConnectionIds: readonly string[];
+}
+/** Grant lifecycle required after an OAuth request has proved its state and initiating actor. */
+export interface ConnectorAuthorizationLifecycle {
+    prepareReauthorization(input: PrepareConnectorReauthorizationInput): Promise<PreparedConnectorReauthorization>;
+    completeNewAuthorization(input: CompleteNewConnectorAuthorizationInput): Promise<ConnectorAuthorizationRecord>;
+    completeReauthorization(input: CompleteConnectorReauthorizationInput): Promise<ConnectorAuthorizationRecord>;
+}
+export interface ConnectorAuthorizationRequestHandlerOptions {
+    readonly projectId: string;
+    readonly storage: Storage;
+    readonly credentialProtector: ConnectorCredentialProtector;
+    readonly authorizationAttemptTtlMs: number;
+    readonly providerOperationTimeoutMs: number;
+    readonly resolveDefinition: ResolveOAuthConnectorDefinition;
+    readonly lifecycle: ConnectorAuthorizationLifecycle;
+    /** Returns the current host signal; the host may replace its controller after closing. */
+    readonly hostSignal: () => AbortSignal;
+}
+export interface PreparedConnectorAuthorizationRequest {
+    readonly definition: OAuthConnectorDefinition;
+    readonly actor: ConnectorConnectionCommandActor;
+    readonly state: string;
+    readonly authorizationUrl: string;
+    readonly attempt: CreateConnectorAuthorizationAttemptInput;
+    readonly affectedConnections: readonly ConnectorConnectionView[];
+}
+/** Owns OAuth request state, PKCE, callback binding, and durable attempt provenance. */
+export declare class ConnectorAuthorizationRequestHandler {
+    private readonly projectId;
+    private readonly storage;
+    private readonly credentialProtector;
+    private readonly authorizationAttemptTtlMs;
+    private readonly providerOperationTimeoutMs;
+    private readonly resolveDefinition;
+    private readonly lifecycle;
+    private readonly hostSignal;
+    constructor(options: ConnectorAuthorizationRequestHandlerOptions);
+    startAuthorization(command: ConnectorConnectionCommandContext, connectorId: string, input: StartConnectorAuthorizationInput): Promise<StartConnectorAuthorizationResult>;
+    prepareAuthorizationRequest(command: ConnectorConnectionCommandContext, connectorId: string, input: StartConnectorAuthorizationInput): Promise<PreparedConnectorAuthorizationRequest>;
+    completeAuthorization(command: ConnectorConnectionCommandContext, connectorId: string, input: CompleteConnectorAuthorizationInput): Promise<CompleteConnectorAuthorizationResult>;
+    completeAuthorizationAttempt(input: {
+        readonly definition: OAuthConnectorDefinition;
+        readonly attempt: ConnectorAuthorizationAttemptRecord;
+        readonly principal: AuthorizablePrincipal;
+        readonly code: string;
+        readonly redirectUri: string;
+        readonly onAuthorizationPersisted?: (authorization: ConnectorAuthorizationRecord) => Promise<void>;
+    }): Promise<ConnectorAuthorizationRecord>;
+    private prepareReauthorization;
+    private consumeAuthorizationAttempt;
+    private completeGrant;
+}
+export {};
+//# sourceMappingURL=request.d.ts.map

package/dist/connectors/connections/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/request.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAE5D,OAAO,KAAK,EACV,mCAAmC,EACnC,4BAA4B,EAC5B,yBAAyB,EAEzB,wCAAwC,EACxC,OAAO,EACR,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAA;AAQlE,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAC1E,OAAO,EAEL,KAAK,+BAA+B,EAErC,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EACV,mCAAmC,EACnC,oCAAoC,EACpC,iCAAiC,EACjC,uBAAuB,EACvB,gCAAgC,EAChC,iCAAiC,EAClC,MAAM,aAAa,CAAA;AAepB,KAAK,wBAAwB,GAAG,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAA;AAElF,MAAM,MAAM,+BAA+B,GAAG,CAAC,WAAW,EAAE,MAAM,KAAK,wBAAwB,CAAA;AAE/F,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAA;IAC7C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAA;CAC1C;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,aAAa,EAAE,4BAA4B,CAAA;IACpD,QAAQ,CAAC,WAAW,EAAE,SAAS,yBAAyB,EAAE,CAAA;CAC3D;AAED,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAA;IAC7C,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAA;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,yFAAyF;IACzF,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC,aAAa,EAAE,4BAA4B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACnG;AAED,MAAM,WAAW,qCACf,SAAQ,sCAAsC;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAA;CAClD;AAED,iGAAiG;AACjG,MAAM,WAAW,+BAA+B;IAC9C,sBAAsB,CACpB,KAAK,EAAE,oCAAoC,GAC1C,OAAO,CAAC,gCAAgC,CAAC,CAAA;IAC5C,wBAAwB,CACtB,KAAK,EAAE,sCAAsC,GAC5C,OAAO,CAAC,4BAA4B,CAAC,CAAA;IACxC,uBAAuB,CACrB,KAAK,EAAE,qCAAqC,GAC3C,OAAO,CAAC,4BAA4B,CAAC,CAAA;CACzC;AAED,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,mBAAmB,EAAE,4BAA4B,CAAA;IAC1D,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAA;IAC1C,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAA;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,+BAA+B,CAAA;IAC3D,QAAQ,CAAC,SAAS,EAAE,+BAA+B,CAAA;IACnD,0FAA0F;IAC1F,QAAQ,CAAC,UAAU,EAAE,MAAM,WAAW,CAAA;CACvC;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAA;IAC7C,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,wCAAwC,CAAA;IAC1D,QAAQ,CAAC,mBAAmB,EAAE,SAAS,uBAAuB,EAAE,CAAA;CACjE;AAED,wFAAwF;AACxF,qBAAa,oCAAoC;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA8B;IAClE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAQ;IAClD,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAQ;IACnD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAiC;IACnE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAC3D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;gBAElC,OAAO,EAAE,2CAA2C;IAiB1D,kBAAkB,CACtB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,iCAAiC,CAAC;IAqBvC,2BAA2B,CAC/B,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,qCAAqC,CAAC;IA0F3C,qBAAqB,CACzB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,mCAAmC,GACzC,OAAO,CAAC,oCAAoC,CAAC;IAuB1C,4BAA4B,CAAC,KAAK,EAAE;QACxC,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAA;QAC7C,QAAQ,CAAC,OAAO,EAAE,mCAAmC,CAAA;QACrD,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAA;QACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;QAC5B,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAClC,aAAa,EAAE,4BAA4B,KACxC,OAAO,CAAC,IAAI,CAAC,CAAA;KACnB,GAAG,OAAO,CAAC,4BAA4B,CAAC;YAa3B,sBAAsB;YA6BtB,2BAA2B;IA0DzC,OAAO,CAAC,aAAa;CA0CtB"}

package/dist/connectors/connections/runs.d.ts

@@ -0,0 +1,51 @@
+import { type Storage } from "../../storage";
+import { type DefaultConnectorAuthorizationLifecycle } from "./authorizations";
+import type { CompleteConnectorConnectionRunInput, CompleteConnectorConnectionRunResult, ConnectorConnectionCommandContext, ConnectorConnectionRunView, SelectConnectorConnectionRunAccountInput, StartConnectorConnectionRunInput, StartConnectorConnectionRunResult } from "./contracts";
+import type { ConnectorAuthorizationRequestHandler, ResolveOAuthConnectorDefinition } from "./request";
+export interface ConnectorConnectionRunServiceOptions {
+    readonly projectId: string;
+    readonly storage: Storage;
+    readonly requestHandler: ConnectorAuthorizationRequestHandler;
+    readonly authorizations: DefaultConnectorAuthorizationLifecycle;
+    readonly resolveDefinition: ResolveOAuthConnectorDefinition;
+    readonly processingTtlMs: number;
+    readonly selectionTtlMs: number;
+    readonly now: () => Date;
+}
+/** Durable orchestration for the user-visible connector connection flow. */
+export declare class ConnectorConnectionRunService {
+    private readonly projectId;
+    private readonly storage;
+    private readonly connectionStorage;
+    private readonly requests;
+    private readonly authorizations;
+    private readonly resolveDefinition;
+    private readonly processingTtlMs;
+    private readonly selectionTtlMs;
+    private readonly now;
+    private readonly maintenanceTimers;
+    constructor(options: ConnectorConnectionRunServiceOptions);
+    startSelection(command: ConnectorConnectionCommandContext, connectorId: string, input: {
+        readonly owner: StartConnectorConnectionRunInput["owner"];
+        readonly slot: string;
+        readonly authorizationId: string;
+    }): Promise<ConnectorConnectionRunView>;
+    start(command: ConnectorConnectionCommandContext, connectorId: string, input: StartConnectorConnectionRunInput): Promise<StartConnectorConnectionRunResult>;
+    complete(input: CompleteConnectorConnectionRunInput): Promise<CompleteConnectorConnectionRunResult>;
+    get(command: ConnectorConnectionCommandContext, connectorId: string, runId: string): Promise<ConnectorConnectionRunView | null>;
+    selectAccount(command: ConnectorConnectionCommandContext, connectorId: string, input: SelectConnectorConnectionRunAccountInput): Promise<ConnectorConnectionRunView>;
+    private claimCallback;
+    private finalizeCompletedRun;
+    private failRun;
+    private cancelRun;
+    private readRun;
+    private assertRunActor;
+    private view;
+    close(): void;
+    private continueRunCleanup;
+    private continuePendingRevocation;
+    private scheduleRunMaintenance;
+    private cancelRunMaintenance;
+    private maintainRun;
+}
+//# sourceMappingURL=runs.d.ts.map

package/dist/connectors/connections/runs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runs.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/runs.ts"],"names":[],"mappings":"AAGA,OAAO,EAML,KAAK,OAAO,EACb,MAAM,eAAe,CAAA;AAEtB,OAAO,EAEL,KAAK,sCAAsC,EAC5C,MAAM,kBAAkB,CAAA;AAKzB,OAAO,KAAK,EACV,mCAAmC,EACnC,oCAAoC,EACpC,iCAAiC,EACjC,0BAA0B,EAC1B,wCAAwC,EACxC,gCAAgC,EAChC,iCAAiC,EAClC,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EACV,oCAAoC,EACpC,+BAA+B,EAChC,MAAM,WAAW,CAAA;AAclB,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,cAAc,EAAE,oCAAoC,CAAA;IAC7D,QAAQ,CAAC,cAAc,EAAE,sCAAsC,CAAA;IAC/D,QAAQ,CAAC,iBAAiB,EAAE,+BAA+B,CAAA;IAC3D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAA;CACzB;AAED,4EAA4E;AAC5E,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA4B;IAC9D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsC;IAC/D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IACvE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAiC;IACnE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAQ;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAmD;gBAEzE,OAAO,EAAE,oCAAoC;IAenD,cAAc,CAClB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE;QACL,QAAQ,CAAC,KAAK,EAAE,gCAAgC,CAAC,OAAO,CAAC,CAAA;QACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;KACjC,GACA,OAAO,CAAC,0BAA0B,CAAC;IA2BhC,KAAK,CACT,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,iCAAiC,CAAC;IAgDvC,QAAQ,CACZ,KAAK,EAAE,mCAAmC,GACzC,OAAO,CAAC,oCAAoC,CAAC;IAiE1C,GAAG,CACP,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAevC,aAAa,CACjB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,wCAAwC,GAC9C,OAAO,CAAC,0BAA0B,CAAC;YA8ExB,aAAa;YA2Db,oBAAoB;YA8DpB,OAAO;YAoCP,SAAS;YAwBT,OAAO;YAeP,cAAc;YAiBd,IAAI;IAgDlB,KAAK,IAAI,IAAI;YAKC,kBAAkB;YAiBlB,yBAAyB;IAgBvC,OAAO,CAAC,sBAAsB;IAe9B,OAAO,CAAC,oBAAoB;YAMd,WAAW;CAsB1B"}

package/dist/connectors/connections/service.d.ts

@@ -0,0 +1,52 @@
+import type { ConnectorConnectionRecord, Storage } from "../../storage";
+import { type ConnectorCredentialProtector } from "../credentials";
+import type { ConnectorClient, ConnectorConnectionSelector, ConnectorDefinition, OAuthConnectorAdapter } from "../types";
+import type { AddConnectorConnectionInput, CompleteConnectorAuthorizationInput, CompleteConnectorAuthorizationResult, CompleteConnectorConnectionRunInput, CompleteConnectorConnectionRunResult, ConnectorConnectionCallbackProcess, ConnectorConnectionCommandContext, ConnectorConnectionProcess, ConnectorConnectionRunView, ConnectorConnectionView, RevokeConnectorAuthorizationResult, SelectConnectorAccountInput, SelectConnectorConnectionRunAccountInput, StartConnectorAuthorizationInput, StartConnectorAuthorizationResult, StartConnectorConnectionRunInput, StartConnectorConnectionRunResult } from "./contracts";
+export interface ConnectorConnectionServiceOptions {
+    readonly storage?: Storage;
+    readonly credentialProtector?: ConnectorCredentialProtector;
+    readonly authorizationAttemptTtlMs?: number;
+    readonly accountSelectionTtlMs?: number;
+    readonly credentialMutationLeaseMs?: number;
+    readonly providerOperationTimeoutMs?: number;
+    readonly connectionRunProcessingTtlMs?: number;
+    readonly refreshSkewMs?: number;
+    readonly now?: () => Date;
+}
+/** Process-owned composition of connector connection lookup and OAuth lifecycle state. */
+export declare class ConnectorConnectionService implements ConnectorConnectionProcess {
+    private readonly projectId;
+    private readonly definitionsById;
+    private abortController;
+    private readonly connectionStorage;
+    private readonly providerOperationTimeoutMs;
+    private readonly authorizations;
+    private readonly requests;
+    private readonly runs;
+    readonly callbackProcess: ConnectorConnectionCallbackProcess;
+    constructor(projectId: string, definitions: readonly ConnectorDefinition[], options?: ConnectorConnectionServiceOptions);
+    connectConnection<TAdapter extends OAuthConnectorAdapter>(definition: ConnectorDefinition<string, TAdapter>, selector: ConnectorConnectionSelector): Promise<ConnectorClient<TAdapter>>;
+    /** Snapshot the connected records that one trusted primitive execution may consume. */
+    listExecutionConnections<TAdapter extends OAuthConnectorAdapter>(definition: ConnectorDefinition<string, TAdapter>): Promise<readonly ConnectorConnectionRecord[]>;
+    /** Resolve a client from an immutable connection snapshot captured for one execution. */
+    connectExecutionConnection<TAdapter extends OAuthConnectorAdapter>(definition: ConnectorDefinition<string, TAdapter>, connection: ConnectorConnectionRecord, signal?: AbortSignal): Promise<ConnectorClient<TAdapter>>;
+    listConnections(command: ConnectorConnectionCommandContext, connectorId: string): Promise<readonly ConnectorConnectionView[]>;
+    startConnectionRun(command: ConnectorConnectionCommandContext, connectorId: string, input: StartConnectorConnectionRunInput): Promise<StartConnectorConnectionRunResult>;
+    addConnection(command: ConnectorConnectionCommandContext, connectorId: string, input: AddConnectorConnectionInput): Promise<ConnectorConnectionRunView>;
+    getConnectionRun(command: ConnectorConnectionCommandContext, connectorId: string, runId: string): Promise<ConnectorConnectionRunView | null>;
+    selectConnectionRunAccount(command: ConnectorConnectionCommandContext, connectorId: string, input: SelectConnectorConnectionRunAccountInput): Promise<ConnectorConnectionRunView>;
+    startReauthorization(command: ConnectorConnectionCommandContext, connectorId: string, connectionId: string, input: Pick<StartConnectorConnectionRunInput, "redirectUri" | "returnTo">): Promise<StartConnectorConnectionRunResult>;
+    revokeConnection(command: ConnectorConnectionCommandContext, connectorId: string, connectionId: string): Promise<RevokeConnectorAuthorizationResult>;
+    completeConnectionRun(input: CompleteConnectorConnectionRunInput): Promise<CompleteConnectorConnectionRunResult>;
+    startAuthorization(command: ConnectorConnectionCommandContext, connectorId: string, input: StartConnectorAuthorizationInput): Promise<StartConnectorAuthorizationResult>;
+    completeAuthorization(command: ConnectorConnectionCommandContext, connectorId: string, input: CompleteConnectorAuthorizationInput): Promise<CompleteConnectorAuthorizationResult>;
+    selectAccount(command: ConnectorConnectionCommandContext, connectorId: string, input: SelectConnectorAccountInput): Promise<ConnectorConnectionView>;
+    disconnect(command: ConnectorConnectionCommandContext, connectorId: string, connectionId: string): Promise<ConnectorConnectionView | null>;
+    revokeAuthorization(command: ConnectorConnectionCommandContext, connectorId: string, authorizationId: string): Promise<RevokeConnectorAuthorizationResult>;
+    close(): Promise<void>;
+    private assertOAuthRegistered;
+    private requireOAuthDefinition;
+    private continueRevocationIfPending;
+    private continuePendingRevocation;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/connectors/connections/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,yBAAyB,EAGzB,OAAO,EACR,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,KAAK,4BAA4B,EAElC,MAAM,gBAAgB,CAAA;AAQvB,OAAO,KAAK,EACV,eAAe,EACf,2BAA2B,EAC3B,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,UAAU,CAAA;AAOjB,OAAO,KAAK,EACV,2BAA2B,EAC3B,mCAAmC,EACnC,oCAAoC,EACpC,mCAAmC,EACnC,oCAAoC,EACpC,kCAAkC,EAClC,iCAAiC,EACjC,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,EACvB,kCAAkC,EAClC,2BAA2B,EAC3B,wCAAwC,EACxC,gCAAgC,EAChC,iCAAiC,EACjC,gCAAgC,EAChC,iCAAiC,EAClC,MAAM,aAAa,CAAA;AAepB,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,4BAA4B,CAAA;IAC3D,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAC3C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;IACvC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAC3C,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAA;IAC5C,QAAQ,CAAC,4BAA4B,CAAC,EAAE,MAAM,CAAA;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAC1B;AAED,0FAA0F;AAC1F,qBAAa,0BAA2B,YAAW,0BAA0B;IAWzE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAV5B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAC1E,OAAO,CAAC,eAAe,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA4B;IAC9D,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAQ;IACnD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IACvE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsC;IAC/D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;IACpD,QAAQ,CAAC,eAAe,EAAE,kCAAkC,CAAA;gBAGzC,SAAS,EAAE,MAAM,EAClC,WAAW,EAAE,SAAS,mBAAmB,EAAE,EAC3C,OAAO,GAAE,iCAAsC;IAwD3C,iBAAiB,CAAC,QAAQ,SAAS,qBAAqB,EAC5D,UAAU,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,EACjD,QAAQ,EAAE,2BAA2B,GACpC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAsBrC,uFAAuF;IACjF,wBAAwB,CAAC,QAAQ,SAAS,qBAAqB,EACnE,UAAU,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,GAChD,OAAO,CAAC,SAAS,yBAAyB,EAAE,CAAC;IAehD,yFAAyF;IACnF,0BAA0B,CAAC,QAAQ,SAAS,qBAAqB,EACrE,UAAU,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,EACjD,UAAU,EAAE,yBAAyB,EACrC,MAAM,GAAE,WAAyC,GAChD,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAiD/B,eAAe,CACnB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC;IAgC9C,kBAAkB,CAChB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,iCAAiC,CAAC;IAIvC,aAAa,CACjB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,0BAA0B,CAAC;IAkCtC,gBAAgB,CACd,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAK7C,0BAA0B,CACxB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,wCAAwC,GAC9C,OAAO,CAAC,0BAA0B,CAAC;IAIhC,oBAAoB,CACxB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,IAAI,CAAC,gCAAgC,EAAE,aAAa,GAAG,UAAU,CAAC,GACxE,OAAO,CAAC,iCAAiC,CAAC;IA8BvC,gBAAgB,CACpB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,kCAAkC,CAAC;IAkB9C,qBAAqB,CACnB,KAAK,EAAE,mCAAmC,GACzC,OAAO,CAAC,oCAAoC,CAAC;IAIhD,kBAAkB,CAChB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,iCAAiC,CAAC;IAI7C,qBAAqB,CACnB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,mCAAmC,GACzC,OAAO,CAAC,oCAAoC,CAAC;IAI1C,aAAa,CACjB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,uBAAuB,CAAC;IAwD7B,UAAU,CACd,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IA8BpC,mBAAmB,CACvB,OAAO,EAAE,iCAAiC,EAC1C,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,kCAAkC,CAAC;IAmBxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAM5B,OAAO,CAAC,qBAAqB;IAY7B,OAAO,CAAC,sBAAsB;YAgBhB,2BAA2B;YAY3B,yBAAyB;CAWxC"}

package/dist/connectors/connections/storage-boundary.d.ts

@@ -0,0 +1,3 @@
+/** Converts raw connector-storage failures before they can cross a Core boundary. */
+export declare function withConnectorStorageBoundary<T>(message: string, operation: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=storage-boundary.d.ts.map

package/dist/connectors/connections/storage-boundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-boundary.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/storage-boundary.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,wBAAsB,4BAA4B,CAAC,CAAC,EAClD,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAMZ"}

package/dist/connectors/connections/tokens.d.ts

@@ -0,0 +1,32 @@
+import type { ConnectorAuthorizationRecord, ConnectorConnectionStorage } from "../../storage";
+import type { ConnectorDefinition, ConnectorTokenSource, OAuthConnectorAdapter } from "../types";
+import type { ConnectorCredentialCodec } from "./credential-codec";
+import { type ConnectorCredentialMutationCoordinator } from "./credential-mutations";
+type OAuthConnectorDefinition = ConnectorDefinition<string, OAuthConnectorAdapter>;
+export interface ConnectorTokenAccessOptions {
+    readonly projectId: string;
+    readonly storage: ConnectorConnectionStorage;
+    readonly credentials: ConnectorCredentialCodec;
+    readonly mutations: ConnectorCredentialMutationCoordinator;
+    readonly refreshSkewMs: number;
+    readonly now: () => Date;
+}
+/** Owns revision-aware access-token delivery and refresh. */
+export declare class ConnectorTokenAccess {
+    private readonly projectId;
+    private readonly storage;
+    private readonly credentials;
+    private readonly mutations;
+    private readonly refreshSkewMs;
+    private readonly now;
+    constructor(options: ConnectorTokenAccessOptions);
+    requireStableActiveAuthorization(definition: OAuthConnectorDefinition, authorizationId: string): Promise<ConnectorAuthorizationRecord>;
+    createTokenSource(definition: OAuthConnectorDefinition, authorizationId: string): ConnectorTokenSource;
+    private open;
+    private getAccessToken;
+    private refreshAuthorization;
+    private requireAuthorization;
+    private adapterContext;
+}
+export {};
+//# sourceMappingURL=tokens.d.ts.map

package/dist/connectors/connections/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAA;AAE7F,OAAO,KAAK,EAEV,mBAAmB,EAEnB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,UAAU,CAAA;AACjB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAClE,OAAO,EAEL,KAAK,sCAAsC,EAE5C,MAAM,wBAAwB,CAAA;AAI/B,KAAK,wBAAwB,GAAG,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAA;AAElF,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAA;IAC5C,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAA;IAC9C,QAAQ,CAAC,SAAS,EAAE,sCAAsC,CAAA;IAC1D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAA;CACzB;AAED,6DAA6D;AAC7D,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA0B;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAY;gBAEpB,OAAO,EAAE,2BAA2B;IAShD,gCAAgC,CAC9B,UAAU,EAAE,wBAAwB,EACpC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,4BAA4B,CAAC;IAIxC,iBAAiB,CACf,UAAU,EAAE,wBAAwB,EACpC,eAAe,EAAE,MAAM,GACtB,oBAAoB;IAMvB,OAAO,CAAC,IAAI;YAaE,cAAc;YAuBd,oBAAoB;YA4IpB,oBAAoB;IAsBlC,OAAO,CAAC,cAAc;CAGvB"}

package/dist/connectors/connections/validation.d.ts

@@ -0,0 +1,27 @@
+import type { ConnectorAuthorizationRecord } from "../../storage";
+import type { ConnectorAccountCandidate, ConnectorOAuthCredentials } from "../types";
+/** Internal validation and normalization shared by the connector connection lifecycle. */
+type ConnectorValidationErrorCode = "connector.adapter_invalid" | "connector.authorization_invalid" | "connector.configuration_invalid";
+export declare function validateCredentials(credentials: ConnectorOAuthCredentials): ConnectorOAuthCredentials;
+export declare function validateAccounts(accounts: readonly ConnectorAccountCandidate[]): readonly ConnectorAccountCandidate[];
+export declare function serializeCredentials(credentials: ConnectorOAuthCredentials): string;
+export declare function parseCredentials(serialized: string): ConnectorOAuthCredentials;
+export declare function shouldRefresh(authorization: ConnectorAuthorizationRecord, now: Date, skewMs: number): boolean;
+export declare function tokenView(credentials: ConnectorOAuthCredentials): {
+    tokenType?: string | undefined;
+    accessToken: string;
+};
+export declare function parseAttemptId(state: string): string;
+export declare function hashSecret(value: string): string;
+export declare function normalizedHttpUrl(value: string | URL, field: string, code?: ConnectorValidationErrorCode): string;
+export declare function assertAuthorizationUrlParameters(authorizationUrl: string, expected: {
+    readonly state: string;
+    readonly codeChallenge: string;
+}): void;
+export declare function nonblank(value: unknown, field: string, code?: ConnectorValidationErrorCode): string;
+export declare function positiveDuration(value: number, field: string): number;
+export declare function nonNegativeDuration(value: number, field: string): number;
+export declare function delay(milliseconds: number): Promise<void>;
+export declare function sameIds(left: readonly string[], right: readonly string[]): boolean;
+export {};
+//# sourceMappingURL=validation.d.ts.map

package/dist/connectors/connections/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/validation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAA;AAEjE,OAAO,KAAK,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAEpF,0FAA0F;AAE1F,KAAK,4BAA4B,GAC7B,2BAA2B,GAC3B,iCAAiC,GACjC,iCAAiC,CAAA;AAErC,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,yBAAyB,GACrC,yBAAyB,CAiE3B;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,SAAS,yBAAyB,EAAE,GAC7C,SAAS,yBAAyB,EAAE,CA0CtC;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,yBAAyB,GAAG,MAAM,CAWnF;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,yBAAyB,CA6C9E;AAED,wBAAgB,aAAa,CAC3B,aAAa,EAAE,4BAA4B,EAC3C,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,MAAM,GACb,OAAO,CAKT;AAED,wBAAgB,SAAS,CAAC,WAAW,EAAE,yBAAyB;;;EAK/D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,GAAG,GAAG,EACnB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,4BAAgE,GACrE,MAAM,CAeR;AAED,wBAAgB,gCAAgC,CAC9C,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACnE,IAAI,CAYN;AAED,wBAAgB,QAAQ,CACtB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,4BAAgE,GACrE,MAAM,CAKR;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQrE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQxE;AAED,wBAAgB,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzD;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAOlF"}

package/dist/connectors/connections/views.d.ts

@@ -0,0 +1,7 @@
+import type { ConnectorAuthorizationRecord, ConnectorConnectionRecord } from "../../storage";
+import type { ConnectorConnectionSelector } from "../types";
+import type { ConnectorConnectionView } from "./contracts";
+/** V1 accepts only project-owned slots; future owner kinds remain explicit extensions. */
+export declare function assertConnectorConnectionSelector(selector: ConnectorConnectionSelector): void;
+export declare function connectorConnectionView(connection: ConnectorConnectionRecord, status: ConnectorAuthorizationRecord["status"]): ConnectorConnectionView;
+//# sourceMappingURL=views.d.ts.map

package/dist/connectors/connections/views.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"views.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/views.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAA;AAE5F,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAA;AAC3D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAG1D,0FAA0F;AAC1F,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,2BAA2B,GAAG,IAAI,CAQ7F;AAED,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,yBAAyB,EACrC,MAAM,EAAE,4BAA4B,CAAC,QAAQ,CAAC,GAC7C,uBAAuB,CAgBzB"}

package/dist/connectors/credentials.d.ts

@@ -0,0 +1,25 @@
+export type ConnectorCredentialPurpose = "oauth-authorization" | "pkce-verifier";
+/** Immutable identity authenticated alongside one sealed connector credential. */
+export interface ConnectorCredentialContext {
+    readonly projectId: string;
+    readonly connectorId: string;
+    readonly recordId: string;
+    readonly purpose: ConnectorCredentialPurpose;
+}
+/** Versioned AEAD envelope safe to persist. */
+export interface SealedConnectorCredential {
+    readonly version: 1;
+    readonly algorithm: "A256GCM";
+    readonly nonce: string;
+    readonly ciphertext: string;
+    readonly tag: string;
+}
+/** Pluggable at-rest protection for connector OAuth credentials and transient PKCE secrets. */
+export interface ConnectorCredentialProtector {
+    seal(plaintext: Uint8Array, context: ConnectorCredentialContext): Promise<SealedConnectorCredential>;
+    open(envelope: SealedConnectorCredential, context: ConnectorCredentialContext): Promise<Uint8Array>;
+}
+/** Create credential protection from the base64url key exposed by Sixb configuration. */
+export declare function createConnectorCredentialProtectorFromKey(encodedKey: string): ConnectorCredentialProtector;
+export declare function createEphemeralConnectorCredentialProtector(): ConnectorCredentialProtector;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/connectors/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/connectors/credentials.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,0BAA0B,GAAG,qBAAqB,GAAG,eAAe,CAAA;AAEhF,kFAAkF;AAClF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAA;CAC7C;AAED,+CAA+C;AAC/C,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACnB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,+FAA+F;AAC/F,MAAM,WAAW,4BAA4B;IAC3C,IAAI,CACF,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,yBAAyB,CAAC,CAAA;IACrC,IAAI,CACF,QAAQ,EAAE,yBAAyB,EACnC,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,UAAU,CAAC,CAAA;CACvB;AAED,yFAAyF;AACzF,wBAAgB,yCAAyC,CACvD,UAAU,EAAE,MAAM,GACjB,4BAA4B,CAkB9B;AA+DD,wBAAgB,2CAA2C,IAAI,4BAA4B,CAE1F"}

package/dist/connectors/errors.d.ts

@@ -1,7 +1,13 @@
+import { type SixbCodedError, type SixbErrorOptions } from "../errors/internal";
+import type { SixbErrorCode } from "../errors/types";
+import { ConnectorConnectionStorageError } from "../storage/connector-connections/errors";
+type ConnectorCodedErrorCode = Extract<SixbErrorCode, `connector.${string}`> | "internal.unexpected";
 /**
- * Base error for the connectors module. Specific subclasses extend this
- * so callers can catch any connector-scoped failure with a single
- * `instanceof ConnectorError` check.
+ * Legacy authoring error for static connector definitions and lookup.
+ *
+ * Persistent connection lifecycle failures use the global `SixbErrorCode` contract instead.
+ * `ConnectorOAuthError` remains a class because adapters and Core need `instanceof` control flow at
+ * the provider-effect boundary.
  */
 export declare class ConnectorError extends Error {
     readonly name: string;
@@ -11,4 +17,30 @@ export declare class ConnectorNotFoundError extends ConnectorError {
     readonly name = "ConnectorNotFoundError";
     constructor(connectorId: string);
 }
+/**
+ * Provider mutation outcome reported by an OAuth adapter.
+ *
+ * `retryable` guarantees that the provider made no change. `terminal` means the current grant can
+ * no longer progress. `ambiguous` means the provider may have changed state; Core fails closed.
+ * This classifies the provider effect, not the final Sixb error retry policy: Core also accounts for
+ * one-use state, consumed authorization codes, and durable mutation phase before choosing a code.
+ */
+export type ConnectorOAuthErrorKind = "retryable" | "terminal" | "ambiguous";
+/** Adapter signal used by Core to decide whether a provider operation can be retried safely. */
+export declare class ConnectorOAuthError extends ConnectorError {
+    readonly kind: ConnectorOAuthErrorKind;
+    readonly name = "ConnectorOAuthError";
+    constructor(kind: ConnectorOAuthErrorKind, message: string, options?: ErrorOptions);
+}
+/** Internal factory for connector failures that cross a Sixb boundary. */
+export declare function createConnectorCodedError(code: ConnectorCodedErrorCode, message: string, options?: SixbErrorOptions): SixbCodedError;
+/** Internal failure used when a provider operation may have completed after Core lost its fence. */
+export declare function createAmbiguousProviderOperationError(options?: SixbErrorOptions): SixbCodedError;
+export declare function oauthErrorKind(error: unknown): ConnectorOAuthErrorKind;
+export declare function providerFailureCode(error: unknown): "connector.provider_failed" | "connector.provider_unavailable";
+export declare function providerBoundaryError(error: unknown, code: "connector.provider_failed" | "connector.provider_unavailable", message: string): Error;
+export declare function isConnectorStorageError(error: unknown, code?: ConnectorConnectionStorageError["code"]): error is ConnectorConnectionStorageError;
+export declare function storageBoundaryError(error: unknown, message: string): SixbCodedError;
+export declare function recoverConnectorFailure<T>(primaryError: unknown, message: string, recovery: () => Promise<T>): Promise<T>;
+export {};
 //# sourceMappingURL=errors.d.ts.map

package/dist/connectors/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/connectors/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAmB;CACzC;AAED,qBAAa,sBAAuB,SAAQ,cAAc;IAE5C,QAAQ,CAAC,WAAW,EAAE,MAAM;IADxC,SAAkB,IAAI,4BAA2B;gBAC5B,WAAW,EAAE,MAAM;CAGzC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/connectors/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAA;AAEzF,KAAK,uBAAuB,GAAG,OAAO,CAAC,aAAa,EAAE,aAAa,MAAM,EAAE,CAAC,GAAG,qBAAqB,CAAA;AAEpG;;;;;;GAMG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAmB;CACzC;AAED,qBAAa,sBAAuB,SAAQ,cAAc;IAE5C,QAAQ,CAAC,WAAW,EAAE,MAAM;IADxC,SAAkB,IAAI,4BAA2B;gBAC5B,WAAW,EAAE,MAAM;CAGzC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,UAAU,GAAG,WAAW,CAAA;AAE5E,gGAAgG;AAChG,qBAAa,mBAAoB,SAAQ,cAAc;IAInD,QAAQ,CAAC,IAAI,EAAE,uBAAuB;IAHxC,SAAkB,IAAI,yBAAwB;gBAGnC,IAAI,EAAE,uBAAuB,EACtC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY;CAIzB;AAED,0EAA0E;AAC1E,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,uBAAuB,EAC7B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,gBAAqB,GAC7B,cAAc,CAMhB;AAED,oGAAoG;AACpG,wBAAgB,qCAAqC,CACnD,OAAO,GAAE,gBAAqB,GAC7B,cAAc,CAMhB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CAEtE;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,GACb,2BAA2B,GAAG,gCAAgC,CAIhE;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,2BAA2B,GAAG,gCAAgC,EACpE,OAAO,EAAE,MAAM,GACd,KAAK,CAGP;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,IAAI,CAAC,EAAE,+BAA+B,CAAC,MAAM,CAAC,GAC7C,KAAK,IAAI,+BAA+B,CAI1C;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAEpF;AAED,wBAAsB,uBAAuB,CAAC,CAAC,EAC7C,YAAY,EAAE,OAAO,EACrB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACzB,OAAO,CAAC,CAAC,CAAC,CAQZ"}

package/dist/connectors/execution.d.ts

@@ -0,0 +1,19 @@
+import type { ExecutionContext } from "../execution";
+import type { SixbRuntimeContext } from "../runtime/types";
+import type { ConnectorService } from "./service";
+import type { AnyConnectorAdapter, ConnectorAdapter, ConnectorClient, ConnectorConnectionMetadata, ConnectorConnectionSelector, ConnectorDefinition, OAuthConnectorAdapter } from "./types";
+/** Resolve a registered connector through one authorized execution. */
+export interface ConnectorRuntime {
+    <TAdapter extends ConnectorAdapter>(definition: ConnectorDefinition<string, TAdapter>): Promise<ConnectorClient<TAdapter>>;
+    <TAdapter extends OAuthConnectorAdapter>(definition: ConnectorDefinition<string, TAdapter>, selector: ConnectorConnectionSelector): Promise<ConnectorClient<TAdapter>>;
+}
+export interface ConnectorExecutionSource<TAdapter extends AnyConnectorAdapter = AnyConnectorAdapter> {
+    readonly connection?: ConnectorConnectionMetadata;
+    connect(signal: AbortSignal): Promise<ConnectorClient<TAdapter>>;
+}
+export interface ConnectorExecutionSourceResolver {
+    list<TAdapter extends AnyConnectorAdapter>(definition: ConnectorDefinition<string, TAdapter>): Promise<readonly ConnectorExecutionSource<TAdapter>[]>;
+}
+export declare function createConnectorRuntime(runtime: SixbRuntimeContext, execution: ExecutionContext, service: ConnectorService): ConnectorRuntime;
+export declare function getConnectorExecutionSourceResolver(connector: ConnectorRuntime): ConnectorExecutionSourceResolver;
+//# sourceMappingURL=execution.d.ts.map

package/dist/connectors/execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../../src/connectors/execution.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAEpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACjD,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,2BAA2B,EAC3B,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,SAAS,CAAA;AAGhB,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,CAAC,QAAQ,SAAS,gBAAgB,EAChC,UAAU,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,GAChD,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAA;IACrC,CAAC,QAAQ,SAAS,qBAAqB,EACrC,UAAU,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,EACjD,QAAQ,EAAE,2BAA2B,GACpC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAA;CACtC;AAED,MAAM,WAAW,wBAAwB,CACvC,QAAQ,SAAS,mBAAmB,GAAG,mBAAmB;IAE1D,QAAQ,CAAC,UAAU,CAAC,EAAE,2BAA2B,CAAA;IACjD,OAAO,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAA;CACjE;AAED,MAAM,WAAW,gCAAgC;IAC/C,IAAI,CAAC,QAAQ,SAAS,mBAAmB,EACvC,UAAU,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,GAChD,OAAO,CAAC,SAAS,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;CAC1D;AAID,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,kBAAkB,EAC3B,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,gBAAgB,GACxB,gBAAgB,CAuDlB;AAaD,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,gBAAgB,GAC1B,gCAAgC,CAwBlC"}